And without suricata running what does nmap report? I mean, maybe it's normal. nmap reports filtered ports when something is blocking the packets.<br>You can also try something like netcat or create a rule with content:"google" and try to fetch it, any other test different to nmap.<br>
<br><div class="gmail_quote">2010/6/11 Anas.B <span dir="ltr"><<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr">After Ctrl+C<br><br>2810] 11/6/2010 -- 15:11:06 - (detect.c:202) <Info> (DetectExitPrintStats) -- 7 sigs per mpm match on avg needed inspection, total mpm searches 5, less than 25 sigs need inspect 5, more than 100 sigs need inspect 0, more than 1000 0 max 19<br>
[2811] 11/6/2010 -- 15:11:06 - (source-nfq.c:533) <Info> (VerdictNFQThreadExitStats) -- (Verdict) Pkts accepted 27, dropped 2000<br>[2813] 11/6/2010 -- 15:11:06 - (alert-fastlog.c:256) <Info> (AlertFastLogExitPrintStats) -- (Outputs) Alerts 2550<br>
[2813] 11/6/2010 -- 15:11:06 - (alert-unified-log.c:304) <Info> (AlertUnifiedLogThreadDeinit) -- Alert unified1 log module wrote 2550 alerts<br>[2813] 11/6/2010 -- 15:11:06 - (alert-unified-alert.c:281) <Info> (AlertUnifiedAlertThreadDeinit) -- Alert unified1 alert module wrote 2550 alerts<br>
[2813] 11/6/2010 -- 15:11:06 - (alert-unified2-alert.c:582) <Info> (Unified2AlertThreadDeinit) -- Alert unified2 module wrote 2550 alerts<br>[2813] 11/6/2010 -- 15:11:06 - (log-httplog.c:391) <Info> (LogHttpLogExitPrintStats) -- (Outputs) HTTP requests 0<br>
[2813] 11/6/2010 -- 15:11:06 - (alert-debuglog.c:254) <Info> (AlertDebugLogExitPrintStats) -- (Outputs) Alerts 2550<br>[2814] 11/6/2010 -- 15:11:06 - (flow.c:767) <Info> (FlowManagerThread) -- 2007 new flows, 2 established flows were timed out, 0 flows in closed state<br>
[2798] 11/6/2010 -- 15:11:06 - (flow.c:588) <Info> (FlowPrintQueueInfo) -- flowbits added: 0, removed: 0, max memory usage: 0<br>[2798] 11/6/2010 -- 15:11:06 - (stream-tcp.c:365) <Info> (StreamTcpFreeConfig) -- Max memuse of stream engine 15021952 (in use 0)<br>
[2798] 11/6/2010 -- 15:11:06 - (detect.c:2492) <Info> (SigAddressCleanupStage1) -- cleaning up signature grouping structure...<br>[2798] 11/6/2010 -- 15:11:07 - (detect.c:2509) <Info> (SigAddressCleanupStage1) -- cleaning up signature grouping structure... done<br>
<br><br>We can see 2000 "dropped"<br><br><br><br><div class="gmail_quote">2010/6/11 Anas.B <span dir="ltr"><<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr">Bjr,<br>oui je crois que t'a raison,<br>quel genre de règle facile que je px bloquer ?<br><br>Merciiiiii<br><br><div class="gmail_quote">2010/6/11 rmkml <span dir="ltr"><<a href="mailto:rmkml@free.fr" target="_blank">rmkml@free.fr</a>></span><div>
<div></div><div><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Bonjour Anas,<br>
suite à l'email de Victor, et je crois que les scan nmap sont particulier, c-a-d que les scans ouvrent de multiples sessions, ce qui n'est pas un cas facile pour commencer...<br>
Essaye plus tot une attaque sur une regle, puis tu l'as bloque... attention au cache des navigatuers web...<br>
a+<br><font color="#888888">
Rmkml</font><div><div></div><div class="h5"><div><div></div><div><br>
<br>
<br>
On Fri, 11 Jun 2010, Anas.B wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
Hello,<br>
<br>
I've replaced "alert" by"drop" where we have "Nmap" rules in emerging-scan.rules file ,<br>
<br>
but I've the same result in Nmap:<br>
<br>
Starting Nmap 5.21 ( <a href="http://nmap.org" target="_blank">http://nmap.org</a> ) at 2010-06-11 14:49 Afr. centrale Ouest<br>
Nmap scan report for 192.168.44.135<br>
Host is up (0.00s latency).<br>
All 1000 scanned ports on 192.168.44.135 are filtered<br>
MAC Address: 00:0C:29:07:11:87 (VMware)<br>
as before !!!<br>
<br>
why the packets aren't dropped ?<br>
<br>
These are the commands applied :<br>
suricata -c /etc/suricata/suricata.yaml -q 0<br>
<br>
and this is the iptables :<br>
<br>
NFQUEUE all -- anywhere anywhere NFQUEUE num 0<br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target prot opt source destination <br>
<br>
Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination <br>
NFQUEUE all -- anywhere anywhere NFQUEUE num 0<br>
<br>
<br>
Kindest regards :)<br>
<br>
Anas<br>
<br>
Nmap done: 1 IP address (1 host up) scanned in 23.16 seconds<br>
<br>
<br>
2010/6/9 Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
All rules might be a bit much, but in essence, yes. But be careful that<br>
some rules might false positive.<br>
<br>
Cheers,<br>
Victor<br>
<br>
Anas.B wrote:<br>
> I've just coppied the emerging rules ,<br>
><br>
> should i copy snort rules also ?<br>
> should i convert all the rules from alert to Drop ?<br>
><br>
><br>
> Thxxx<br>
><br>
><br>
> 2010/6/9 Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>><br>
><br>
> Making progress :)<br>
><br>
> Do you have drop rules? Normally a rule is "alert ip any any -> any any<br>
> ... " etc. but you need "drop ip any any -> any ...." Did you convert<br>
> your rules?<br>
><br>
> The TmqDebugList statements are debug stuff, you can ignore that.<br>
><br>
> Cheers,<br>
> Victor<br>
><br>
> Anas.B wrote:<br>
> > Thank you so much, for ur help :)<br>
> ><br>
> > this time I've these lines :<br>
> ><br>
> > 'pickup-queue', len 0<br>
> > TmqDebugList: id 1, name 'decode-queue1', len 0<br>
> > TmqDebugList: id 2, name 'stream-queue1', len 49<br>
> > TmqDebugList: id 3, name 'verdict-queue', len 0<br>
> > TmqDebugList: id 4, name 'respond-queue', len 1<br>
> > TmqDebugList: id 5, name 'alert-queue1', len 0<br>
> ><br>
> > after an Nmap scan<br>
> ><br>
> ><br>
> > after CTRL+C<br>
> ><br>
> > I've this :<br>
> ><br>
> > 4:33 - (suricata.c:1033) <Info> (main) -- signal received<br>
> > [8495] 9/6/2010 -- 16:04:33 - (suricata.c:1069) <Info> (main) -- time<br>
> > elapsed 176s<br>
> > [8500] 9/6/2010 -- 16:04:33 - (source-nfq.c:522) <Info><br>
> > (ReceiveNFQThreadExitStats) -- (ReceiveNFQ) Pkts 6028, Bytes 256012,<br>
> > Errors 0<br>
> > [8502] 9/6/2010 -- 16:04:33 - (stream-tcp.c:2634) <Info><br>
> > (StreamTcpExitPrintStats) -- (Stream1) Packets 6014<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:172) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) (1byte) Pkts 6028, Searched 0<br>
> (0.0).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:175) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) (2byte) Pkts 6028, Searched 4<br>
> (0.1).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:178) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) (3byte) Pkts 6028, Searched 0<br>
> (0.0).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:181) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) (4byte) Pkts 6028, Searched 0<br>
> (0.0).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:184) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) (+byte) Pkts 6028, Searched 0<br>
> (0.0).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:188) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) URI (1byte) Uri's 0, Searched<br>
> 0 (-nan).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:191) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) URI (2byte) Uri's 0, Searched<br>
> 0 (-nan).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:194) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) URI (3byte) Uri's 0, Searched<br>
> 0 (-nan).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:197) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) URI (4byte) Uri's 0, Searched<br>
> 0 (-nan).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:200) <Info><br>
> > (DetectExitPrintStats) -- (Detect1) URI (+byte) Uri's 0, Searched<br>
> 0 (-nan).<br>
> > [8503] 9/6/2010 -- 16:04:33 - (detect.c:202) <Info><br>
> > (DetectExitPrintStats) -- 4 sigs per mpm match on avg needed<br>
> inspection,<br>
> > total mpm searches 2, less than 25 sigs need inspect 2, more than 100<br>
> > sigs need inspect 0, more than 1000 0 max 5<br>
> > [8504] 9/6/2010 -- 16:04:33 - (source-nfq.c:533) <Info><br>
> > (VerdictNFQThreadExitStats) -- (Verdict) Pkts accepted 6028, dropped 0<br>
> > [8506] 9/6/2010 -- 16:04:33 - (alert-fastlog.c:256) <Info><br>
> > (AlertFastLogExitPrintStats) -- (Outputs) Alerts 3792<br>
> > [8506] 9/6/2010 -- 16:04:33 - (alert-unified-log.c:304) <Info><br>
> > (AlertUnifiedLogThreadDeinit) -- Alert unified1 log module wrote<br>
> 3792 alerts<br>
> > [8506] 9/6/2010 -- 16:04:33 - (alert-unified-alert.c:281) <Info><br>
> > (AlertUnifiedAlertThreadDeinit) -- Alert unified1 alert module wrote<br>
> > 3792 alerts<br>
> > [8506] 9/6/2010 -- 16:04:33 - (alert-unified2-alert.c:582) <Info><br>
> > (Unified2AlertThreadDeinit) -- Alert unified2 module wrote 3792 alerts<br>
> > [8506] 9/6/2010 -- 16:04:33 - (log-httplog.c:391) <Info><br>
> > (LogHttpLogExitPrintStats) -- (Outputs) HTTP requests 0<br>
> > [8506] 9/6/2010 -- 16:04:33 - (alert-debuglog.c:254) <Info><br>
> > (AlertDebugLogExitPrintStats) -- (Outputs) Alerts 3792<br>
> > [8507] 9/6/2010 -- 16:04:33 - (flow.c:767) <Info><br>
> (FlowManagerThread) --<br>
> > 6 new flows, 1000 established flows were timed out, 0 flows in<br>
> closed state<br>
> > [8495] 9/6/2010 -- 16:04:33 - (flow.c:588) <Info> (FlowPrintQueueInfo)<br>
> > -- flowbits added: 0, removed: 0, max memory usage: 0<br>
> > [8495] 9/6/2010 -- 16:04:33 - (stream-tcp.c:365) <Info><br>
> > (StreamTcpFreeConfig) -- Max memuse of stream engine 15021952 (in<br>
> use 0)<br>
> > [8495] 9/6/2010 -- 16:04:33 - (detect.c:2492) <Info><br>
> > (SigAddressCleanupStage1) -- cleaning up signature grouping<br>
> structure...<br>
> > [8495] 9/6/2010 -- 16:04:33 - (detect.c:2509) <Info><br>
> > (SigAddressCleanupStage1) -- cleaning up signature grouping<br>
> structure...<br>
> > done<br>
> ><br>
> ><br>
> > is this normal ?<br>
> > (just alerts no Dropped !!!!)<br>
> ><br>
> > I've done the Nmap scan from Windows<br>
> ><br>
> ><br>
> > Sorry for the inconvenience<br>
> > Cheers<br>
> ><br>
> ><br>
> ><br>
> > 2010/6/9 Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>>><br>
> ><br>
> > In the config below you only send outgoing HTTP traffic to<br>
> Suricata. To<br>
> > inspect all do:<br>
> ><br>
> > iptables -A INPUT -j NFQUEUE<br>
> > iptables -A OUTPUT -j NFQUEUE<br>
> ><br>
> > Cheers,<br>
> > Victor<br>
> ><br>
> > Anas.B wrote:<br>
> > > I didn't configure Iptables,<br>
> > ><br>
> > > now i have the two lines<br>
> > ><br>
> > > Chain INPUT (policy ACCEPT)<br>
> > > target prot opt source destination<br>
> > > NFQUEUE tcp -- anywhere anywhere tcp<br>
> > spt:www<br>
> > > NFQUEUE num 0<br>
> > ><br>
> > > Chain FORWARD (policy ACCEPT)<br>
> > > target prot opt source destination<br>
> > ><br>
> > > Chain OUTPUT (policy ACCEPT)<br>
> > > target prot opt source destination<br>
> > > NFQUEUE tcp -- anywhere anywhere tcp<br>
> > dpt:www<br>
> > > NFQUEUE num 0<br>
> > ><br>
> > > But still no alerts/Drop/reject nmap scan<br>
> > ><br>
> > > Best Regards<br>
> > ><br>
> > > 2010/6/9 Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
> > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
> > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>>>><br>
> > ><br>
> > > In that case you'd need:<br>
> > ><br>
> > > iptables -A OUTPUT -p tcp --dport 80 -j NFQUEUE<br>
> > > iptables -A INPUT -p tcp --sport 80 -j NFQUEUE<br>
> > ><br>
> > > This would send outgoing http traffic (the vm browsing<br>
> the web) to<br>
> > > Suricata.<br>
> > ><br>
> > > Cheers,<br>
> > > Victor<br>
> > ><br>
> > > Anas.B wrote:<br>
> > > > No, I'm just trying this in local Virtual Machine Ubuntu).<br>
> > > ><br>
> > > > since there is no much Doc, i'm a little lost.<br>
> > > ><br>
> > > > thaks a lot<br>
> > > ><br>
> > > ><br>
> > > > 2010/6/9 Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
> > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>><br>
> > > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>>><br>
> > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>><br>
> > > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>>>>><br>
> > > ><br>
> > > > Did you add the appropriate iptables rules?<br>
> > > ><br>
> > > > For example for getting port 80 to suricata:<br>
> > > ><br>
> > > > iptables -A FORWARD -p tcp --dport 80 -j NFQUEUE<br>
> > > ><br>
> > > > Cheers,<br>
> > > > Victor<br>
> > > ><br>
> > > > Anas.B wrote:<br>
> > > > ><br>
> > > > > Hello,<br>
> > > > ><br>
> > > > > I've just tested a nmap,<br>
> > > > ><br>
> > > > > I noticed more unified files<br>
> > > > > and alerts in the file fast.log<br>
> > > > > new values in alert-debug.log and stats.log<br>
> > > > ><br>
> > > > > that means it works !!<br>
> > > > ><br>
> > > > > But with the command ==> *# suricata -c<br>
> > > > /etc/suricata/suricata.yaml -q 0<br>
> > > > ><br>
> > > > > *I have no logs,<br>
> > > > > any suggestions<br>
> > > > ><br>
> > > > > thanks :)<br>
> > > > ><br>
> > > > ><br>
> > > > ><br>
> > > ><br>
> > ><br>
> ><br>
> ------------------------------------------------------------------------<br>
> > > > ><br>
> > > > > _______________________________________________<br>
> > > > > Oisf-users mailing list<br>
> > > > > <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>><br>
> > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>>><br>
> > > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>><br>
> > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>>>><br>
> > > > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>><br>
> > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>>><br>
> > > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>><br>
> > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a>>>>><br>
> > > > ><br>
> > ><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> > > ><br>
> > > ><br>
> > > > --<br>
> > > > ---------------------------------------------<br>
> > > > Victor Julien<br>
> > > > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> > > > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> > > > ---------------------------------------------<br>
> > > ><br>
> > > ><br>
> > ><br>
> > ><br>
> > > --<br>
> > > ---------------------------------------------<br>
> > > Victor Julien<br>
> > > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> > > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> > > ---------------------------------------------<br>
> > ><br>
> > ><br>
> ><br>
> ><br>
> > --<br>
> > ---------------------------------------------<br>
> > Victor Julien<br>
> > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> > ---------------------------------------------<br>
> ><br>
> ><br>
><br>
><br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
><br>
><br>
<br>
<br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
<br>
<br>
<br>
</blockquote>
</div></div></div></div></blockquote></div></div></div><br></div>
</blockquote></div><br></div>
<br>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Best regards,<br>--<br>Pablo Rincón Crespo<br>Security researcher and developer<br>Open Information Security Foundation (OISF)<br><br><br>